In one embodiment, a protected archive is checked for malicious content by checking a file size of the archive and/or examining the archive for notable characteristics indicative of malicious content. The notable characteristics may include values in a header of the archive. For example, the file name extension of a file contained in the archive and the compression method used to create the archive may be taken into account in determining whether the archive has malicious content, such as a worm or a virus. Embodiments of the present invention allow for detection of malicious content in the protected archive without necessarily having to extract files from the archive.
|
16. A method to be performed by a computer, the method comprising:
receiving an e-mail in the computer, the e-mail including a protected archive;
checking a header of the archive to determine if the archive is likely to contain malicious content without extracting an archived file in the archive.
1. A method to be performed by a server computer, the method comprising:
receiving a protected archive in the server computer, the protected archive including an archived file, the protected archive being configured to prevent extraction of the archived file except manually by a user at a client computer; and
examining the protected archive for notable characteristics indicative of an archive that has been generated by a malicious program.
13. A computer having a processor for executing computer-readable program code in a memory, the memory comprising:
computer-readable program code for checking a file size of a protected archive containing an archived file, the protected archive being protected by a password;
computer-readable program code for checking a value in a header of the protected archive;
computer-readable program code for determining if the archived file comprises an executable file; and
computer-readable program code for determining if the protected archive includes a virus based on the file size of the protected archive, the value in the header of the protected archive, and whether the archived file comprises an executable file.
5. The method of
6. The method of
7. The method of
8. The method of
9. The method of
10. The method of
(a) checking a file size of the protected archive;
(b) checking for particular values in a header of the protected archive after step (a); and
(c) checking if the archived file is an executable file after step (b).
11. The method of
15. The computer of
17. The method of
checking a file size of the archive to determine if the archive is likely to contain malicious content.
18. The method of
checking for an executable file in the archive to determine if the archive is likely to contain malicious content.
19. The method of
20. The method of
|
1. Field of the Invention
The present invention relates generally to computer systems, and more particularly but not exclusively to techniques for detecting malicious content.
2. Description of the Background Art
Malicious programs, such as computer viruses, spy wares, worms, and Trojans, pose a significant threat to computer systems. For example, a computer virus can corrupt or delete important files, send e-mails without user authorization, render a computer inoperable, or cause other types of damage to a computer. Computers may incorporate antivirus programs as a protective measure against viruses. An antivirus program may open a file and then scan the file for malicious content.
As a countermeasure against antivirus programs, a malicious program may be embedded in a password protected archive. An example of such a malicious program is the so-called “BAGLE” worm. The BAGLE worm propagates by mass-mailing copies of itself using SMTP (Simple Mail Transfer Protocol). The BAGLE worm also opens a backdoor that allows a hacker to upload and run programs on infected computers.
The BAGLE worm arrives in a password protected archive, which is included as an attachment to an e-mail. The password required to extract files from the archive is included in the message body of the e-mail. The password is provided as a text file in the early versions of the worm. This allows an antivirus program to parse the message body to obtain the password, which in turn allows the antivirus program to extract files from the archive for scanning. However, later versions of the worm include the password as a graphical image. This prevents an antivirus program from obtaining the password needed to extract files from the archive.
In one embodiment, a protected archive is checked for malicious content by checking a file size of the archive and/or examining the archive for notable characteristics indicative of malicious content. The notable characteristics may include values in a header of the archive. For example, the file name extension of a file contained in the archive and the compression method used to create the archive may be taken into account in determining whether the archive has malicious content, such as a worm or a virus. The archive may be inspected at a server computer prior to the archive being provided to a user at a client computer. The notable characteristics may be included in a pattern file of an antivirus program to facilitate updates when new notable characteristics of malicious programs are discovered. Embodiments of the present invention allow for detection of malicious content in the protected archive without necessarily having to extract files from the archive.
These and other features of the present invention will be readily apparent to persons of ordinary skill in the art upon reading the entirety of this disclosure, which includes the accompanying drawings and claims.
The use of the same reference label in different drawings indicates the same or like components.
In the present disclosure, numerous specific details are provided, such as examples of apparatus, components, and methods, to provide a thorough understanding of embodiments of the invention. Persons of ordinary skill in the art will recognize, however, that the invention can be practiced without one or more of the specific details. In other instances, well-known details are not shown or described to avoid obscuring aspects of the invention.
Being computer-related, it can be appreciated that the components disclosed herein may be implemented in hardware, software, or a combination of hardware and software (e.g., firmware). Software components may be in the form of computer-readable program code stored in a computer-readable storage medium, such as memory, mass storage device, or removable storage device. For example, a computer-readable storage medium may comprise computer-readable program code for performing the function of a particular component. Likewise, computer memory may be configured to include one or more components, which may then be executed by a processor. Components may be implemented separately in multiple modules or together in a single module.
Embodiments of the invention are described herein using e-mails and archived files as examples. It should be understood, however, that the invention is not so limited and may be generally employed in applications requiring detection of malicious content in protected data.
In one embodiment, an antivirus program 320 is installed and running in a server computer, such as the gateway computer 110. This advantageously allows the antivirus program 320 to scan data for malicious content before the data is received in the client computer 130 or other computers in the network. Running the antivirus program 320 at a server computer also simplifies maintenance because the network administrator has only one (or a few) central location where antivirus program updates need to be performed.
The antivirus program 320 may be configured to check an incoming e-mail 102 or outgoing e-mail 101 for malicious content. For example, the antivirus program 320 may be configured to check an incoming e-mail 102 at the gateway computer 110 before the incoming e-mail 102 is received by a user at the client computer 130. In other embodiments, the antivirus program 320 is installed and running in the client computer 130. In that embodiment, the antivirus program 320 checks an incoming e-mail 102 before e-mail 102 is presented to the user, or an outgoing e-mail 101 before e-mail 101 is transmitted out of client computer 130.
Referring now to
In the example of
In one embodiment, a signature based detection technique is used to determine if a protected archive contains malicious content. The signature based detection technique advantageously does not require file extraction, and may thus be used even if the archive cannot be opened by an antivirus program. The signature based detection technique may rely on notable characteristics of known bad archives. Antivirus researchers may observe the notable characteristics of bad archives, and incorporate those characteristics as filters in pattern files employed by antivirus programs. In one embodiment, the notable characteristics indicative of a bad archive include file size, and certain values in file headers, such as the compression method used, whether the archive is password protected, and name of files contained in the archive. Note that the header of a typical archive is readable without having to open the archive. In other words, the header of an archive is normally available for inspection even if the archive is protected.
Beginning in step 402, a protected archive is received in a computer. The computer may be a server computer or a client computer, for example. The archive may contain one or more files and be protected with a password. For example, the archive may be a password protected zip or RAR file. The protected archive may be configured to prevent extraction of archived files except manually by a user at a client computer, for example.
In step 404, the scanning engine 321 checks the size of the archive, individual files in the archive, or both. For example, the header of a zip archive contains a local file header for each archived file. The local file header may be examined to determine the compressed, uncompressed, or both sizes of an archived file. The size of the entire archive may also be taken into account.
In step 406, the scanning engine 321 compares the size of the archive, individual files in the archive, or both to those of known bad archives. The file sizes for known bad archives may be included in the pattern file 322. If the size of the archive or any file in the archive is within range of those known to be associated with a malicious program, method 400 continues to step 410. Otherwise, the archive may be assumed to be a good (i.e., not bad) archive, as indicated in step 408.
For example, assuming that an archived file in a BAGLE worm-generated archive is known to have a compressed size of 44 KB to 46. KB and the received archive has a single archived file having a compressed size of 50 KB, it may be assumed that the received archive was not generated by the BAGLE worm. Otherwise, additional filtering steps may be needed to minimize the number of false positives (i.e., false alarms).
In step 410, the scanning engine 321 examines the header of the received archive for notable characteristics. Such notable characteristics may include the compression method used and other values in the header of the archive. For example, in some bad archives using the zip format, the compression method (offset 0x8 in the local file header) used is 0x0, and the difference between the compressed size (offset 0x12 in the local file header) and the uncompressed size (offset 0x16 in the local file header) is 0xC. The just mentioned header values may be included in the pattern file 322 for use by the scanning engine 321 in determining whether a zip archive is likely to be a bad archive. Note that the header of a zip archive includes a central directory in addition to local file headers. Only the values in the local file headers may be examined and taken into account for performance reasons. Values in the central directory may also be examined and taken into account to minimize false positives.
In the path from step 412 to step 408, the received archive may be assumed to be a good archive if its header does not have a value matching that of known bad archives. Otherwise, method 400 continues in step 414.
In step 414, the scanning engine 321 checks the received archive for executable files. Step 414 may be performed by examining the file name extensions of files in the archive. For example, in the Microsoft Windows™ operating system environment, files with file name extensions of “.exe”, “.scr”, and “.pif” are executable files and are likely to harm the computer if the received archive turns out to be a bad archive. In some archives (e.g., zip), the file name extensions of archived files may be determined by examining the header of the archive.
In the path from step 416 to step 408, the received archive may be assumed to be a good archive if it does not contain executable files. Otherwise, as indicated in step 418, the received archive may be assumed to be a bad archive.
In the example of
While specific embodiments of the present invention have been provided, it is to be understood that these embodiments are for illustration purposes and not limiting. Many additional embodiments will be apparent to persons of ordinary skill in the art reading this disclosure.
Reyes, Crescencio F., Malibiran, Ed Israel S., Bautista, Ronald C.
Patent | Priority | Assignee | Title |
10116688, | Mar 24 2015 | CA, INC | Systems and methods for detecting potentially malicious files |
7730540, | Dec 08 2004 | CA, INC | Method for scanning protected components of electronic messages |
8042184, | Oct 18 2006 | Kaspersky Lab, ZAO | Rapid analysis of data stream for malware presence |
8074280, | Dec 12 2006 | Fortinet, Inc. | Detection of undesired computer files in archives |
8151355, | Dec 12 2006 | Fortinet, Inc. | Detection of undesired computer files in archives |
8166550, | Dec 12 2006 | Fortinet, Inc. | Detection of undesired computer files in damaged archives |
8327447, | Dec 12 2006 | Fortinet, Inc. | Detection of undesired computer files in archives |
8549314, | Apr 29 2010 | King Saud University | Password generation methods and systems |
8793798, | Dec 12 2006 | Fortinet, Inc. | Detection of undesired computer files in archives |
9003531, | Oct 01 2009 | AO Kaspersky Lab | Comprehensive password management arrangment facilitating security |
9798878, | Mar 31 2015 | CA, INC | Systems and methods for detecting text display manipulation attacks |
Patent | Priority | Assignee | Title |
5442699, | Nov 21 1994 | TREND MICRO INCORPORATED | Searching for patterns in encrypted data |
5452442, | Jan 19 1993 | TREND MICRO INCORPORATED | Methods and apparatus for evaluating and extracting signatures of computer viruses and other undesirable software entities |
5907834, | May 13 1994 | TREND MICRO INCORPORATED | Method and apparatus for detecting a presence of a computer virus |
6192512, | Sep 24 1998 | TREND MICRO INCORPORATED | Interpreter with virtualized interface |
6279128, | Dec 29 1994 | TREND MICRO INCORPORATED | Autonomous system for recognition of patterns formed by stored data during computer memory scrubbing |
6622134, | Jan 05 1999 | TREND MICRO INCORPORATED | Method of constructing data classifiers and classifiers constructed according to the method |
6711583, | Sep 30 1998 | IBM Corporation | System and method for detecting and repairing document-infecting viruses using dynamic heuristics |
6789200, | May 18 2000 | TREND MICRO INCORPORATED | Method of automatically instituting secure, safe libraries and functions when exposing a system to potential system attacks |
6813712, | May 27 1999 | TREND MICRO INCORPORATED | Viral replication detection using a counter virus |
7043634, | May 15 2001 | JPMORGAN CHASE BANK, N A , AS ADMINISTRATIVE AGENT | Detecting malicious alteration of stored computer files |
20040260636, | |||
20060053180, | |||
EP1377892, | |||
WO2084459, | |||
WO2005047862, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
Jun 05 2004 | REYES, CRESCENCIO F | TREND MICRO INCORPORATED | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 015560 | /0329 | |
Jul 05 2004 | MALIBIRAN, ED ISRAEL S | TREND MICRO INCORPORATED | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 015560 | /0329 | |
Jul 05 2004 | BAUTISTA, RONALD C | TREND MICRO INCORPORATED | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 015560 | /0329 | |
Jul 07 2004 | TREND MICRO INCORPORATED | (assignment on the face of the patent) | / |
Date | Maintenance Fee Events |
Jun 18 2012 | REM: Maintenance Fee Reminder Mailed. |
Nov 04 2012 | EXP: Patent Expired for Failure to Pay Maintenance Fees. |
Apr 09 2019 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
Apr 09 2019 | M1552: Payment of Maintenance Fee, 8th Year, Large Entity. |
Apr 09 2019 | M1558: Surcharge, Petition to Accept Pymt After Exp, Unintentional. |
Apr 09 2019 | PMFP: Petition Related to Maintenance Fees Filed. |
Oct 21 2019 | PMFG: Petition Related to Maintenance Fees Granted. |
May 04 2020 | M1553: Payment of Maintenance Fee, 12th Year, Large Entity. |
Date | Maintenance Schedule |
Nov 04 2011 | 4 years fee payment window open |
May 04 2012 | 6 months grace period start (w surcharge) |
Nov 04 2012 | patent expiry (for year 4) |
Nov 04 2014 | 2 years to revive unintentionally abandoned end. (for year 4) |
Nov 04 2015 | 8 years fee payment window open |
May 04 2016 | 6 months grace period start (w surcharge) |
Nov 04 2016 | patent expiry (for year 8) |
Nov 04 2018 | 2 years to revive unintentionally abandoned end. (for year 8) |
Nov 04 2019 | 12 years fee payment window open |
May 04 2020 | 6 months grace period start (w surcharge) |
Nov 04 2020 | patent expiry (for year 12) |
Nov 04 2022 | 2 years to revive unintentionally abandoned end. (for year 12) |